Every withdrawal from GOAT's BitVM3 bridge is backed by a proof that can be challenged on Bitcoin. This is the prover behind those proofs, why the team building the bridge builds it too, and how the prover itself is checked.
When bitcoin moves onto another network, a bridge holds it on the Bitcoin network and decides when it can leave. GOAT Network is building its bridge on BitVM3, where that decision is enforced by Bitcoin: every withdrawal is held open to challenge for at least a week, and any dispute is resolved on Bitcoin. What a dispute examines is a proof. The proofs come from Ziren, the zkVM built in-house by the same core team that is building the bridge.
What the prover does for the bridge
Ziren is a zkVM: it runs a program and produces a short proof that the program ran correctly, which anyone can check in milliseconds without running the program again. GOAT uses it in two places. Every batch of transactions on GOAT carries a Ziren proof that it was executed correctly, and every withdrawal from the bridge is backed by a Ziren proof.
A withdrawal works like this. A user burns their bridged bitcoin on GOAT, and an operator pays them out on Bitcoin from its own funds. To be repaid from the bridge, the operator has to show that it followed the bridge's rules, and its evidence is a proof generated by Ziren. The operator's claim is held open for at least a week. If anyone challenges it in that time, the dispute is resolved on Bitcoin, and a claim whose proof doesn't hold up fails.
The GOAT BitVM3 whitepaper sets out the full design.
Where Ziren sits in the BitVM3 bridge: it proves the setup once, when bitcoin is deposited, and every repayment claim after that. If a claim is challenged, Bitcoin checks a single hash.
BitVM3 is the third generation of this design, and each generation has cut what Bitcoin itself has to do in a dispute. The original BitVM could take up to 70 transactions over weeks, BitVM2 cut that to three, and in BitVM3 Bitcoin checks a single hash. Since BitVM2, what gets checked is a SNARK, a short proof made by a prover. On the GOAT Network bridge, that prover is Ziren.
Three generations of BitVM, compared by what a dispute asks of Bitcoin. Figures from the BitVM, BitVM2 and BitVM3 papers.
What the bridge's safety rests on
The bridge's security rests on two assumptions. The first concerns people: the bridge stays safe as long as one honest participant checks the work during the challenge window. The second concerns proofs: nobody can produce a valid proof of something that isn't true. In a dispute, Bitcoin checks the proof. It doesn't replay GOAT Network's history to confirm that a withdrawal really happened; confirming that is what the proof is for.
The second assumption puts the prover inside the bridge's security model. A zkVM proves that a program ran correctly by turning each step of it into equations, and a proof shows that all of the equations hold. If the equations for some step allow more than one result for the same input, a dishonest prover can pick the result it wants and produce a valid proof of something that never happened, such as a withdrawal nobody made. A challenger checking that proof on Bitcoin would find nothing wrong with it, because the flaw would be in the prover's equations rather than in the proof.
For a BitVM bridge, then, the correctness of the prover matters as much as the challenge process around it. That correctness has two parts: the engineering that turns a program's rules into equations, which is where bugs are found in practice, and the mathematics the proofs rely on, which is where post-quantum security comes in.
The bridge's security rests on two assumptions: one honest participant checks the work during the challenge window, and nobody can produce a valid proof of something untrue. The second depends on the prover.
Why the team building the bridge builds the prover
Ziren is built in-house by the same core team that is building the bridge, and is developed in the open under ZKM. One team answers for everything a withdrawal depends on, from the instructions the prover executes to the Bitcoin transactions that resolve a dispute.
The prover has been shaped around the bridge as a result. Ziren's October 2025 release added support for proving Bitcoin's chain of block headers, along with built-in versions of the cryptographic operations used in the bridge's garbled-circuit verification. Earlier that year, on GOAT's BitVM2 beta testnet, Ziren proved blocks in about 2.6 seconds, inside the network's 3.4-second block time.
The bridge also sets the order of priorities. Much of the zkVM industry's attention over the past two years has gone to speed. Underneath a bridge, a slow proof costs a short delay, while a proof that can be faked puts the bridge's bitcoin at risk, so security has led Ziren's development.
The same thinking explains Ziren's instruction set. Ziren proves programs compiled for MIPS32r2, a mature instruction set, and keeps that base fixed. ZKM's reasoning draws directly on Bitcoin: "'Don't break consensus' in Bitcoin maps to 'don't break constraints' in ZKM". A base that doesn't change lets audits and tests carry over from one release to the next, instead of being redone whenever the instruction set grows.
How the prover is checked
Engineering bugs are found by people and tools looking for them, and no single method finds all of them, so Ziren is checked in several independent ways.
Published design. Ziren's design, security arguments and measurements are set out in the Ziren paper, published on the IACR Cryptology ePrint Archive in October 2026.
Public proving. In August 2025, Ziren's verifier went live on Ethproofs, the Ethereum Foundation's open proving dashboard, letting anyone check Ziren's proofs of Ethereum blocks in a browser.
Independent audit. Veridise audited Ziren by reviewing its circuits by hand, checking them with formal tools and fuzzing them. The findings were fixed and re-verified, the results were published in January 2026, and the report is in Ziren's repository.
Adversarial research. Since December 2025, Consensys Diligence and researchers at TU Wien have worked with the Ziren team and the Ethereum Foundation, which introduced them. They generate large numbers of test programs to catch any point where compiling, running, proving and verifying disagree, and use AI agents to hunt for vulnerabilities. Findings are fixed and independently re-verified, and the work is ongoing.
GOAT's bug bounty. For six weeks from August 18th, researchers tested the BitVM3 bridge, including its proving stack. The program classified 123 findings and awarded 16, all of which will be fixed before the bridge carries mainnet BTC.
Machine-checked proofs. In October 2025, the team proved with Veridise's tools that Ziren's addition-and-subtraction circuit is deterministic: for a given input, only one output satisfies its equations. Ziren 2.0 extends this to 57 circuits, with 104 theorems machine-checked in the Lean proof assistant. Determinism rules out the flaw described above, where a dishonest prover gets to choose the result, and for those circuits it is established by proof rather than by review.
Each method catches things the others miss, and the work continues with every release.
How Ziren has been checked, from its verifier going live on Ethproofs in August 2025 to Ziren 2.0 in November 2026.
Ziren 2.0
Ziren 2.0, released on November 4th, replaces the proof system at Ziren's core with a new one and ships with the Lean proofs described above. For the bridge, 2.0 matters most as the foundation for the next stage of the security work.
Post-quantum security
The other half of the prover's security is the mathematics underneath it. A large enough quantum computer would break the elliptic-curve cryptography that much of crypto relies on, while hash functions are expected to hold up. In Ziren 2.0, the commitments at the core of every proof, the part that binds a prover to its answers, are hash-based throughout. But hash-based is not the same as post-quantum: a proof is only as strong as its weakest part. Ziren's proof pipeline still uses elliptic curves in two places: the check that keeps memory consistent inside each proof, and the final step that compresses a proof for checking onchain. Both need replacing before Ziren's proofs can be called post-quantum.
Work to replace the memory check is tracked in the open, with 2.0 as its base. It is part of a wider effort: GOAT Network's post-quantum security is being built across the stack, including moving the decentralized sequencer's consensus keys to ML-DSA-65, a NIST post-quantum signature standard.
One limit applies to every Bitcoin bridge: the bitcoin locked in it sits behind Bitcoin's own signatures until Bitcoin itself upgrades. GOAT Network controls everything built above that, and the aim is for none of it to become the weaker link. Applied PQC, the post-quantum research group led by GOAT CTO Stephen Duan, sets out the full picture in its report on post-quantum migration for Bitcoin L2s, with GOAT Network as the case study.
Where elliptic curves remain, from GOAT’s sequencer down to Bitcoin. In Ziren 2.0 the commitments are hash-based, while the memory check and final compression still use elliptic curves and need replacing.
The same prover on Ethereum
Ziren's work extends beyond GOAT Network to Ethereum. On Ethproofs, the Ethereum Foundation's open proving dashboard, Ziren 2.0 proves the average Ethereum mainnet block in 8.6 seconds on four GPUs, under Ethereum's 12-second block time. Ziren is also being brought to Metis, one of the earliest Ethereum L2s, as the prover for its Hybrid Rollup. Metis announced the Hybrid Rollup in 2023 with zkMIPS, Ziren's original name, as its prover, and the design is now being completed for post-quantum security.
For GOAT, this puts the code behind its bridge under wider scrutiny: it proves Ethereum's own blocks in public, and a second network will depend on it. The post-quantum work is shared too: the memory check being replaced on Metis's path to post-quantum security is part of every proof Ziren produces for GOAT.
The prover and Bitcoin settlement
The bridge is being built so that Bitcoin can be the settlement layer for the network, and so that everything on GOAT, including payments made by AI agents, inherits Bitcoin's security. Every withdrawal through that bridge will be backed by a proof, and a proof is only as trustworthy as the prover that produced it. That is why the team building the bridge also builds Ziren, and why security has led its development. Checking the prover is ongoing work, and each release of Ziren carries more of it.
GOAT.Network is Bitcoin-secured infrastructure for agentic commerce. The core GOAT stack comprises a Type-1 zkEVM for full Ethereum compatibility, a decentralized sequencer set, a BitVM3 bridge secured by a purpose-built zkVM, and a complete agent commerce layer on top: identity, payments, and reputation for building economic agents.
